{"record":{"id":"ad9d8ef7511b82ff","repo":"garrytan/gstack","slug":"invalid-css-property-name-property-only-lette-ad9d8e","errorCode":null,"errorMessage":"Invalid CSS property name: ${property}. Only letters and hyphens allowed.","messagePattern":"Invalid CSS property name: (.+?)\\. Only letters and hyphens allowed\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"browse/src/write-commands.ts","lineNumber":780,"sourceCode":"\n    case 'style': {\n      // style --undo [N] → revert modification\n      if (args[0] === '--undo') {\n        const idx = args[1] ? parseInt(args[1], 10) : undefined;\n        await undoModification(page, idx);\n        return idx !== undefined ? `Reverted modification #${idx}` : 'Reverted last modification';\n      }\n\n      // style <selector> <property> <value>\n      const [selector, property, ...valueParts] = args;\n      const value = valueParts.join(' ');\n      if (!selector || !property || !value) {\n        throw new Error('Usage: browse style <sel> <prop> <value> | style --undo [N]');\n      }\n\n      // Validate CSS property name\n      if (!/^[a-zA-Z-]+$/.test(property)) {\n        throw new Error(`Invalid CSS property name: ${property}. Only letters and hyphens allowed.`);\n      }\n\n      // Validate CSS value — block data exfiltration patterns\n      const DANGEROUS_CSS = /url\\s*\\(|expression\\s*\\(|@import|javascript:|data:/i;\n      if (DANGEROUS_CSS.test(value)) {\n        throw new Error('CSS value rejected: contains potentially dangerous pattern.');\n      }\n\n      const mod = await modifyStyle(page, selector, property, value);\n      return `Style modified: ${selector} { ${property}: ${mod.oldValue || '(none)'} → ${value} } (${mod.method})`;\n    }\n\n    case 'cleanup': {\n      // Parse flags\n      let doAds = false, doCookies = false, doSticky = false, doSocial = false;\n      let doOverlays = false, doClutter = false;\n      let doAll = false;\n","sourceCodeStart":762,"sourceCodeEnd":798,"githubUrl":"https://github.com/garrytan/gstack/blob/94993f74012782fd94416dd44b8314f6363a13a4/browse/src/write-commands.ts#L762-L798","documentation":"Thrown by `browse style` when the property name fails the regex `/^[a-zA-Z-]+$/`. The command only accepts standard CSS property names composed of ASCII letters and hyphens (e.g. `color`, `background-color`, `font-size`). This guards the subsequent `modifyStyle` call which interpolates the property into a CSS rule string, preventing injection of arbitrary CSS or JS-triggers via the property slot. Note CSS custom properties (`--my-var`) are NOT accepted because the regex requires at least one letter and allows hyphens but the leading `--` form has no letter before the first hyphen segment — actually `--my-var` contains letters so it PASSES; the real rejection targets underscores, digits-leading tokens, and non-ASCII.","triggerScenarios":"Passing `background_color` (underscore not allowed), `backgroundColor` (camelCase — no hyphen, but the letters pass... actually camelCase like `backgroundColor` matches `[a-zA-Z-]+` since it is all letters with no hyphen, so it PASSES the regex but may not be a valid CSS property in that form); `1color` (leading digit rejected); `color!` (punctuation rejected); a property name with a trailing space that survived trim.","commonSituations":"User passes a JavaScript CSSOM camelCase name (`backgroundColor`) instead of the CSS kebab-case (`background-color`) — note this passes the regex but `modifyStyle` may still mis-handle it; user passes a vendor-prefixed property with an underscore typo; an LLM emits `--custom` with a leading space; a property name copied from a minified CSS source contained an escape character.","solutions":["Use the CSS kebab-case property name: `background-color`, not `backgroundColor` or `background_color`.","Ensure the property contains only ASCII letters and hyphens — no underscores, digits at the start, or punctuation.","Custom properties (`--my-var`) are accepted as they contain letters and hyphens.","If you need to set a property the regex rejects, verify it is a real CSS property; non-standard or invented names are intentionally blocked."],"exampleFix":"// before\nawait runBrowseCommand(['style', 'body', 'background_color', 'red']);\n\n// after\nawait runBrowseCommand(['style', 'body', 'background-color', 'red']);","handlingStrategy":"validation","validationCode":"function validateCssProperty(property: string): void {\n  if (!/^[a-zA-Z-]+$/.test(property)) {\n    throw new Error(`Invalid CSS property name: ${property}. Only ASCII letters and hyphens allowed.`);\n  }\n}","typeGuard":"function isCssPropertyName(s: string): boolean {\n  return /^[a-zA-Z-]+$/.test(s);\n}","tryCatchPattern":null,"preventionTips":["Use CSS kebab-case property names (background-color, not background_color).","Avoid underscores, leading digits, and non-ASCII in property names.","Custom properties (--my-var) are accepted since they contain letters and hyphens."],"tags":["cli-usage","style","css","validation","security","browse-command"],"analyzedSha":"94993f74012782fd94416dd44b8314f6363a13a4","analyzedAt":"2026-08-12T04:06:23.140Z","schemaVersion":2},"datasetVersion":"2026-08-12T12:17:08.281Z"}